ATTCK

ATT&CK, often written as ATT&CK or MITRE ATT&CK, is a publicly accessible knowledge base of adversary behaviors used in cybersecurity. It provides a structured description of the tactics, techniques, and procedures (TTPs) that threat actors have observed in real-world campaigns. The framework is designed to help organizations understand how attacks unfold, assess their defenses, and improve detection and response.

The core concept of ATT&CK is the matrix of tactics and techniques. Tactics represent the attacker’s aims at high level, such as Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. Techniques describe specific methods adversaries use to achieve those aims, and often include subtechniques that add further granularity. Each technique is associated with example procedures, observable indicators, mitigation guidance, and mapping to defensive controls.

The MITRE ATT&CK framework has several editions, including Enterprise ATT&CK, Mobile ATT&CK, and ICS ATT&CK, reflecting different operational contexts. PRE-ATT&CK was an early collection of adversary behaviors observed before formal technique adoption. The ATT&CK Navigator is a visualization tool that helps users layer, explore, and share mappings between techniques and detections. The framework is continuously updated to reflect new threats and techniques as they are observed in the wild.

Uses and applications of ATT&CK include threat modeling, gap analysis of security controls, red teaming and adversary emulation planning, detection engineering, and security operations center workflows. It is widely employed to benchmark detections, align security investments with observed risk, and communicate findings across technical and leadership audiences.